Welcome to Splunk Answers, a Q&A forum for users to find answers to questions about deploying, managing, and using Splunk products. Contributors of all backgrounds and levels of expertise come here to find solutions to their issues, and to help other users in the Splunk community with their own questions.

This quick tutorial will help you get started with key features to help you find the answers you need. You will receive 10 karma points upon successful completion!

Refine your search:

How to find out how many logs an index gets in a 24-hour period?

0

Afternoon Splunk Gurus

I wonder if you would be as kind to help \ point me in the right direction ?I'm new to Splunk and still getting used to extracting data, I'm looking to find out how to get the total number of logs which go to an index in a set time period ? (24 hours)

Or even how to get all the Indexes currently in Splunk and log source and number of logs in last 24hours.

Hi DDewarSplunk.beware: if you use dedup command you haven't the real total count of events sent to Indexes!

Anyway stats count by index gives you the number of events for each index, if you want the number of sources, you have to use stats dc(sources) as sources by indexyou can also display both the information: